What’s Vulnerable › Vulnerabilities
CVE-2026-5590: net: ip/tcp: Null pointer dereference can be triggered by a race condition
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-04-05 · updated 2026-10-15
- Weakness: CWE-476
Description
A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.
Affected products
- zephyrproject zephyr: through 4.3.0
References
Get alerted when CVE-2026-5590 or the next vulnerability affects your stack